rapid7-insightidr 1.14.2: query a log set by name; Static widens UBA windows

query_log_set accepts log_set_name and resolves the id itself (exact name, or
the one set whose name contains it; otherwise refused with the existing
names): on a real run the model mangled a 36-character id it copied. Static
queries by name, retries a 0-event keyword search case-insensitively, takes
the 24 hours before a behaviour alert (they aggregate hours of activity), and
always looks for the user's other investigations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -38,22 +38,30 @@ instructions: |
   3. Alerts with evidence_api true: get_alert_actors, then get_alert_evidence.
   4. Alerts with evidence_api false, and any alert whose evidence did not
      answer: the logs.
-     - list_log_sets (1 call). Pick by the alert type:
+     - list_log_sets (1 call) to see the names. Then query_log_set with
+       log_set_name — the NAME, e.g. "Asset Authentication" — never a copied
+       log_set_id: a 36-character id gets mangled in the copy.
+     - Pick by the alert type:
        * authentication / lateral movement / "new assets" / "Domain
-         Credentials": the Asset Authentication log set first, then the Active
-         Directory ones. Never File Access or File Modification for these.
-       * process / endpoint alerts: the Endpoint Agent log sets.
-     - query_log_set with a keyword search, no field names:
-       where("<user, host or IP>"), e.g. where("jdoe"). Always parentheses,
-       always quotes; no groupby or calculate.
-     - Window: from 30 minutes before the alert's first seen time to 30
-       minutes after its last seen time (start_time / end_time, ISO-8601).
-       The two can be inverted in the data: take the earlier as the start.
+         Credentials": Asset Authentication first. An Active Directory name
+         shared by several sets is refused as ambiguous: give the full name of
+         one domain controller's set.
+       * process / endpoint alerts: the Endpoint Agent log set.
+       * Never File Access or File Modification for an authentication alert.
+     - Keyword search, no field names: where("<user, host or IP>"), e.g.
+       where("jdoe"). If it returns 0 events, try once more
+       case-insensitively: where(/jdoe/i). Always parentheses; no groupby or
+       calculate.
+     - Window. A behaviour (UBA) alert aggregates activity over hours — its
+       count of "new assets" keeps growing after it is raised — so take the 24
+       hours before its first seen time, up to 30 minutes after its last seen
+       time. Other alerts: 30 minutes on each side. First and last seen can be
+       inverted in the data: take the earlier as the start.
      - "Invalid Query Syntax": report the exact query and error, no variants.
      - Keep at most 6 calls for logs.
-  5. Keep 1 call for search_investigation(actor_user_name=<user>): other
-     investigations of the same user. It takes start_time / end_time, not
-     time_range; empty, it covers the last 28 days.
+  5. ALWAYS call search_investigation(actor_user_name=<user>) once, whatever
+     the logs gave: other investigations of the same user. It takes
+     start_time / end_time, not time_range; empty, it covers 28 days.
 
   In your answer, list the hosts and IPs the logs show for the user — that is
   what an analyst needs from a "new assets" alert — and say which log set and